Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 24 Sep 2002 01:09:43 +0200

=> That's right and that is not /64 spoofing, that is
a /128 spoofing. /64 spoofing would be when the attacker
uses an address A:anything.

  > >
  > 
  > I think we are talking about two different kinds of 
  > spoofing. What I mean is
  > that the attacker can spoof any address with a valid prefix 
  > on the link,
  > regardless if the prefix is a /128 or a /64. I don't mean 
  > that it can spoof a
  > different prefix, which the router is not routing.

=> And I think we agree on that. The FMIP draft 
allows the spoofing of a /64 though. This is 
my concern.

Hesham

  >             jak

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 08:47:49 -0700

> allows the spoofing of a /64 though. This is

No it doesn't.

Suppose, again, that the new access router was routing address K received via
HI/HaCK from the old router, which consisted of a prefix H and a host identifier
J, H:J. That is to say, the old access router supports prefix H. Suppose the new
access router supports prefix X.

The new access router does ingress filtering on X. The new access router doesn't
have to accept any address with prefix H just because it accepts K. It only
accepts K.

If an attacker tries to use an address H:Q, where Q != J, the ingress filter
rejects it because H != X. However, the address H:J is sent properly because the
source route has been inserted.

Therefore, ingress filtering is irrelevent. It will work just fine on the new
access router, but is subject to the same constraints as ingress filtering in
general.

            jak